MTD-STD-01 · Customer Due Diligence Standard (v2.0)

Mittenda Limited · Customer Due Diligence Standard (v2.0) · specimen excerpt

Synthetic specimen. Mittenda Limited is a fictional firm. This document is invented, derived from scenarios seen in practice, and contains deliberate deficiencies for demonstration. It is not a template and must not be adopted.

Document control: MTD-STD-01 · owner: Head of Financial Crime · approved: Risk and Compliance Committee, 18 September 2025 · classification: Internal · next review due: September 2026.

[Earlier versions omitted]

Contents

1. Purpose
2. Customer risk rating
3. Identification
4. Verification methods
5. Enhanced due diligence
6. Reliance on third parties
7. Periodic review

Appendix A: Acceptable identity documents · Appendix B: Notified electronic identification schemes

Sections in bold are excerpted below.

[Sections 1 and 2 omitted]

3. Identification

3.1 For natural persons, the information established at identification is the full legal name, the date of birth and the residential address.

3.2 For legal persons, it is the registered legal name, the registered number and the registered office, together with the natural persons authorised to act for the customer, whose identity is established as §3.1 provides.

3.3 The beneficial owners of a customer that is a legal person are identified, and the identity of each is established as §3.1 provides.

3.4 The information established under this section is recorded on the customer account record, and is amended only through the customer due diligence process.

4. Verification methods

4.1 Identity is verified against documents, data or information obtained from a reliable and independent source. Acceptable documentary evidence for natural persons is a valid passport, national identity card or residence permit, examined for validity and consistency with the information established at identification. For legal persons, it is the constitutional documents and an extract from the relevant companies register no older than three months.

4.2 Electronic verification may be used where it draws on electronic identification means issued under a scheme notified in accordance with Regulation (EU) No 910/2014, at assurance level substantial or high, or on independent data sources that together meet the reliable-and-independent test.

4.3 Verification is completed before the establishment of the business relationship or the execution of the first transaction. It may be completed during the establishment of the relationship where necessary not to interrupt the normal conduct of business and the assessed risk is low, and in any event before any transaction is executed.

[Sections 5 and 6 omitted]

7. Periodic review

7.1 The customer file is reviewed periodically, on a cycle set by the customer risk rating established under §2. A review reconfirms the information established at identification under §3, re-verifies it to the extent the cycle or §7.3 requires, and re-assesses the customer risk rating.

7.2 The review cycle:

7.3 A review is performed outside the cycle, and the cycle reset, on any of the following: a material change to the customer's identity information; the expiry of an identity document relied upon at verification; a change in the ownership or control of a customer that is a legal person; adverse media concerning the customer or a beneficial owner; a sanctions nexus identified under the Sanctions Screening Standard; and a material change in the customer's activity relative to the expected activity established at onboarding, whether identified under the Transaction Monitoring Standard or otherwise.

7.4 Each review is recorded with its date, the information reconfirmed, the evidence relied upon, the resulting customer risk rating and the person completing it. Where a review results in re-verification, the evidence is recorded as it is at verification under §4. Records evidencing the review are retained in accordance with the Record Retention Policy.

7.5 Completion of the review cycle is owned by the Head of Payments Operations, whose function maintains the customer account record for both services. The Head of Financial Crime owns this Standard, sets the cycle in §7.2 and the events in §7.3, and reviews a risk-based sample of completed reviews.

7.6 Reviews past due are reported monthly to the Risk and Compliance Committee against the tolerance set in the Risk Appetite Statement §5.3, and are cleared within 60 days of falling due. A review that cannot be completed because the customer has not provided information requested of them is escalated to the Head of Financial Crime for a decision on the continuation of the business relationship.

[Appendices omitted]